User-system partition: device-group state sync (profile, trust records, contacts, devices)

[lannbot]

Design and build the user-system partition: system-level user state synced across the user's device group, using the engine's normal doc machinery but with the framework itself as schema authority — chrome-consumed anti-spoofing state stays TCB-authored; same mechanics as data services (#21), not an installable one.

From the 2026-08-19 design discussion. The pairing/enrollment ceremony is tracked on #10; the user-creation flow and first-run tutorial are the followup issue.

Candidate docs (doc = ACL unit; owner = the user's device group, no other members):

• profile — display name, icon, chrome anchor colour. The Framework visor: trusted code, position+secret authentication, input suspension - the framework's own UI #22 strip colour becomes per-user and synced; remote changes must be announced (extends the announced-reset ruling — silent anchor drift inverts the training).
• marks — the trust/petname table (Framework visor: trusted code, position+secret authentication, input suspension - the framework's own UI #22, PR Chrome petnames: user-assigned names demote self-declared ones (#22) #31), keyed by unforgeable provenance.
• contacts — received contact cards as replicated state (the G3 wedge finding: cards must reach every member instance).
• devices — device names/annotations over the keyhive group (the group is the membership authority; this is the annotation layer; feeds the future revoke-device UI).

Design points:

• Merge vs invariants: petname local-uniqueness (case-insensitive) and hue local-uniqueness are cross-record constraints LWW cannot preserve under concurrent assignment on two devices; the schema authority defines post-merge repair, and every remotely-caused recognition change is announced in chrome.
• Eviction repair: Safari-eviction currently means an announced reset; with this partition, re-enrollment restores marks/hue/name — the reset gains a recovery path.
• Explicitly NOT synced: keystore CryptoKeys (structurally device-local; each device escrows its own credentials — PR Engine egress by named import; S3 secret as non-extractable signing handle (#7, #11) #32 posture), durable grants (deferred; device-specific capabilities argue per-device — revisit with Permission model: linking as enforcement - deny-by-unlink, prompt-on-first-use, revocation semantics, durable grants #6), storage config sans secrets (later; needs the secret/config split from Framework visor: trusted code, position+secret authentication, input suspension - the framework's own UI #22).
• Bootstrap ordering: a newly paired device needs membership ops + partition refs before its first pull — delivered by the pairing ceremony (Identity: devices as leaves, user as signed device list; enrollment ceremony; contact exchange and verification #10) over the pairing connection, with K_p pickup as the offline-completion path.

[lannbot]

Executed (PR #40; contract in spikes/tasks-engine/PAIRING.md): one user-system doc (profile / marks / contacts / devices) behind a us-* driver surface that hides doc identity, delegated to the user group only; deterministic post-merge invariant repair (older created-at wins, tie-break lexicographic provenance; petname loser reports needs-reconfirm for chrome's NEW-with-explanation treatment; hue loser reassigned the smallest unused palette index — hues are indices into the #22 palette now, not angles; exhaustion stands silently); per-instance drained us-events with local-echo suppression. Chrome side: marks/hue/name behind the seam, localStorage demoted to boot cache, announcements sticky-prioritized.

Finding that changed the design — post-seal adds don't become readers at the pinned keyhive rev. A device enrolled into the user group after a doc was sealed receives every chunk and decrypts none — including post-join writes; forced PCS rotation after the add does not repair it; behavior is op-order-dependent (the G3 wedge class; the joiner can derive its own epochs — directional failure). Control: freshly created partitions are stably readable. Full writeup in the spike README.

Resolution: enrollment regenerates the doc. The adder creates a successor (create → delegate → seal, joiner in epoch 0), copies state values with created-at preserved (it decides conflict winners), writes a fork-visible forward-pointer map into the old generation; devices follow with bounded hops and reconcile only their own missing values (no resurrection of others' deletions); the announcement baseline carries across generations (no double-announce). Copied-state handoff is also the right read-back window for this data — nobody needs marks history on a new device.

Recorded consequences:

• Production shape: per-family docs + the Envelope content format so causal keys can serve late joiners properly (try_encrypt_content today encrypts raw content — no envelope, no causal read-back). The us-* surface hiding doc identity is what makes that swap chrome-invisible.
• Regeneration is O(state) per enrollment and drops automerge history — fine at spike scale, wants the split before partitions grow.
• Generation forks from concurrent enrollments: detect-and-report (lexicographic-smallest wins); wants a real gate before pairing stops being humanly serialized.
• Upstream-issue candidate drafted in the README (post-seal-add wedge); filing is a separate decision.

[lannbot]

Attribution corrected, twice — final state: there was no bug anywhere.

1. spikes/keyhive-addwedge (keyhive-only repro, N=10 per scenario, pinned rev AND upstream main — which are the same commit; the earlier belief that the pin predated the ratcheting change was wrong): keyhive grants post-seal-added members readable epochs in every legitimate shape, 140/140. The reported symptom reproduces on demand from a stale delivered event set alone (scenario f) — with keyhive behaving correctly.
2. Engine instrumentation then showed the bridge delivers correctly too (per-peer reachability exact; post-join envelopes open with the forced rotation OFF and the ENROLL card suppressed, 10/10 order-independent). The original red gate conflated envelope decryption with automerge materialization: a late joiner opens post-join envelopes fine but cannot materialize them, because their dependency chains root in pre-join changes that stay dark by designed non-retroactivity — and automerge buffers changes with missing deps rather than erroring. The KeyNotFound spam was the pre-join chunks, i.e. the design.

Consequences, recorded in PAIRING.md + the spike README (PR #40):

• Doc regeneration is reclassified: not a defect workaround but the state-handoff mechanism — the correct read-back window for user-system data until the Envelope content format lands, at which point causal-key read-back replaces it and the generation/fork machinery retires. This raises Envelope's priority as the thing that deletes machinery.
• The forced post-add rotation is defence in depth (deliberate epoch boundary at enrollment), not the readability mechanism; measured with a bisect switch that keeps the claim re-runnable.
• stats now separates us-decrypted (envelopes opened) from us-revision (state materialized) — the conflation that produced the misdiagnosis is now structurally hard to repeat.
• Nothing to file upstream; the addwedge draft is explicitly marked not-fileable-as-bug. Upstream sweep found no matching defect reports (their #206 is the adjacent event-completeness lesson; their merged PR #199 tests exactly the transitive-decrypt path).
• One honestly-unresolved observation stands in the README: a late duplicate card re-ingest reports all events as new — not load-bearing (delivery was settled by the card-suppressed run), flagged so nobody reads that counter as a set difference.

Methodological note worth keeping: the misdiagnosis and one discarded instrument failed the same way — treating a convenient number (op counts, unstable digests) as set identity. Gates now assert the boundary explicitly (post-join opens; pre-join EXPECTED-dark).

[lannbot]

Envelope slice executed (PR #42; PAIRING.md §4b): the content spine seals Envelope{ chunk, ancestor-keys-of-parents } and reads back through the causal walk. Enrollment hands the joiner the ORIGINAL doc — the devices-entry write doubles as the walk anchor — and the regeneration/forward-pointer/value-reconcile/fork machinery is deleted. The partitioned-writes hazard class went with it: one lineage, native CRDT merge on heal, gated including the forget-does-not-resurrect case.

Now-open items this promotes:

• Chain-cut policy memo (User-system partition: device-group state sync (profile, trust records, contacts, devices) #36/Group crypto: decision memo - MLS vs DCGKA vs Keyhive/BeeKEM for E2E sync and sharing #9): with envelopes, read-back is total by default — correct for a user's own devices, a policy decision for late-added collaborators on shared partitions. Natural cut points: compaction/summary boundaries.
• Independent review of keyhive's envelope scheme (CAUTION-flagged upstream; NOTES threat-model record): now load-bearing for shipping, no longer deferrable-by-abstinence.
• Format-generation migration (Data services: the polymorph:automerge surface - document as ACL unit, host-side ownership, indexing, encrypted backup #8 seam): old/new format devices mutually present as undecryptable; nothing detects it.
• Walk-cost shaping for long histories (remember permanently-dark chunks + direct entrypoints).